Baker & McKenzie LLP Chicago Office One Prudential Plaza, Suite 3500 130 East Randolph Drive Chicago, Illinois 60601 USA Tel: +1 312 861 3077 Fax: +1 312 861 2899 brian.hengesbaugh@bakermckenzie.com www.bakermckenzie.com Brian Hengesbaugh Partner Practice Areas Privacy/Information Technology/Sourcing Practice Focus Regulatory and transactional issues, including privacy and data protection, data security and information technology, sourcing, digital and electronic signatures, email and telemarketing, bank secrecy, cyber crime, and jurisdiction and the enforcement of foreign judgments. Practice Description Brian Hengesbaugh provides advice to a wide range of global manufacturers, financial institutions, pharmaceutical companies, health care providers, sourcing providers, retail companies, online businesses, and other organizations regarding the legal aspects of global privacy and data protection, data security, information technology, and related restrictions on data collection and movement. He focuses on these issues in the context of: litigation, internal investigations, and government inquiries; sourcing and corporate transactions; and global company operations and applications. Specific areas include compliance by U.S. organizations with federal and state privacy laws and consumer protection requirements, including: the Gramm-Leach-Bliley Act ( GLBA ); the Electronic Signatures in Global and National Commerce Act ( E-SIGN ); the Uniform Electronic Transactions Act ( UETA ); the Fair Credit Reporting Act ( FCRA ) as amended by the Fair and Accurate Credit Transactions Act ( FACT Act ); the CAN-SPAM Act; the Health Insurance Portability and Accountability Act ( HIPAA ), the Electronic Communications Privacy Act ( ECPA ) and related laws; the various California and other State privacy, telemarketing, electronic signature, and data security laws; as well as global privacy concerns under the Canadian Personal Information Protection and Electronic Documents Act ( PIPEDA ), the EU Directive on Data Protection, the EU Electronic Signature Directive, the national laws implementing the Asia Pacific Economic Cooperation ( APEC ) Framework on Privacy, and Constitutional privacy provisions and related laws in Latin America. Formerly Special Counsel to the General Counsel of the U.S. Department of Commerce, Mr. Hengesbaugh played a key role in the development and implementation of the U.S. Government s domestic and international policy in the area of privacy and electronic commerce. In particular, he served as the lead attorney on the U.S. side negotiating the U.S.-EU Safe Harbor Privacy Arrangement. He also served as a U.S. delegate to the Electronic Commerce Working Group of the United Nations, where he helped negotiate the UN Model Law on Electronic Signatures. In addition, Mr. Hengesbaugh participated on behalf of the United States in the development of a draft Council of Europe Treaty on Cyber Crime, and in the negotiation of a draft Hague Convention on Jurisdiction and the Recognition of Foreign Judgments. Mr. Hengesbaugh s extensive experience representing the U.S. Government in these matters provides him with an in-depth understanding of the Baker & McKenzie LLP is a member of Baker & McKenzie International, a Swiss Verein.
disparate approaches that various jurisdictions take to the regulation of privacy and e- commerce. It also provides him with unique insight and ability to forge practical solutions to complex cross-border privacy and regulatory compliance issues. Publications, Presentations and Articles Mr. Hengesbaugh is an excellent public speaker, and is particularly well known for his presentations on European and U.S. data protection, privacy, information security, and electronic signature issues, including: What Every Employer Needs to Know About Management of HR Data, Baker & McKenzie Client Seminar (Palo Alto, CA)(April 2010). Data Security Requirements Evolve From Reasonableness to Specifics, International Association of Privacy Professionals (IAPP) Summit (Washington, DC)(April 2010). Cross-Border Selling, Social Networking, and Advertising, In-House Client Training Session (New York)(February 2010). Preparing for the Future: What s Next From the Federal Regulators, Privacy and Security of Consumer and Employee Information, American Conference Institute (Washington, DC) (January 2010). Effective Global Records Management Strategies, Baker & McKenzie Global Privacy Strategy (GPS) Webinar Series (Chicago, IL) (December 2009). Global Data Privacy and Information Management: Comparative Analysis of International Data Transfer Vehicles, Baker & McKenzie Global Privacy Strategy (GPS) Webinar Series (Chicago, IL) (July 2009). Multi-Jurisdictional Privacy Compliance & Data Security: A Practical Perspective, The 9th Annual IT Law Spring Training Program, IT.Can and The Law Society of Upper Canada (Toronto, ON) (May 2009). Worldwide Data Privacy Programs, Baker & McKenzie Corporate Compliance Webinar (Chicago, IL) (April 2009). Key Elements of Effective Codes of Conduct, Baker & McKenzie Corporate Compliance Webinar (Chicago, IL) (March 2009). The Extended Enterprise: Tax and Legal Issues in Global Sourcing, Sourcing Interest Group (SIG) Webinar (Chicago, IL)(November 2008). A Fly in the Ointment: How to Manage Conflicts Between Global Privacy Laws and US Demands for Data and Documents, Privacy Academy for the International Association of Privacy Professionals (Orlando, FL)(September 2008). The Extended Enterprise: Legal Hazards in Global Sourcing, The Outsourcing Institute (Chicago, IL)(April 2008) 2
Managing Compliance Programs in a Global Environment, Firm Seminar on Corporate Compliance in the Global Environment (Washington, DC)(February 2008). Security Breach: Legal Risks and Notification Requirements, Executives Club of Chicago Conference on Risk Management: Privacy and Insider Threats (Chicago, IL)(December 2007). What s Private About HR in a Global Economy? Privacy Academy for the International Association of Privacy Professionals (San Francisco, CA)(October 2007). The Extended Enterprise: Legal Hazards in Global Sourcing, Firm Webinar on Corporate Compliance (Chicago, IL)(September 2007). Data Security Breaches: A New Litigation Frontier, Firm Webinar on Corporate Compliance (Chicago, IL)(July 2007). Getting Your House in Order: Strategic Spring Cleaning on Global Privacy Issues, Annual Privacy Summit for the International Association of Privacy Professionals (Washington, DC) (March 2007). Next Generation Compliance Challenges in Global Sourcing: Audit, Privacy, and Social Responsibility, Firm Seminar on Sourcing Traps in a Regulated World (New York, New York) (February 2007). Foreign Data Restrictions on Global Anti-Money Laundering Programs, BITS Financial Services Roundtable Forum on Anti-Money Laundering (Washington, DC) (July 2006). Third Party Due Diligence and Monitoring: Meeting Domestic and International Safeguarding Requirements for Data and Privacy, ACI Insurance Industry Forum on Consumer Privacy and Data Protection (New York, NY) (June 2006). Upgrading Your Information Security Program to Meet Regulatory Requirements and Operational Best Practices, ACI Forum on Security Breaches and Identity Theft (San Francisco, CA) (March 2006). Sourcing in India: Current Issues in Business, Employment and Labor Law, National Foreign Trade Council Forum on Sourcing in India (Chicago, IL) (December 2005). Ensuring Secure and Compliant Processes When Using Third Parties and Consultants, American Conference Institute Forum on Security Breaches and Identity Theft (New York, NY) (September 2005). Managing Risk in Global Offshoring and Outsourcing, Baker & McKenzie Webinar Series on Expanding Your Business Globally (Chicago, IL) (July 2005). Privacy and Direct Selling, Shh! What You Can Say (and Know) About Your Customers, Direct Selling Association Annual Forum (Washington, DC) (March 2005). Global Privacy Strategies, American Conference Institute on Consumer Privacy and Information Security in Financial Institutions (Washington, DC) (January 2005). 3
The Safe Harbor and Other Approaches to EU Data Privacy Issues, US Department of Commerce Forum (Chicago, Illinois) (November 2004). Compliance Challenges in the Regulation of Advertising, Spam, and Consumer Protection Online, Canadian IT Law Association (Calgary, Alberta) (October 2004). The Expanding Web of Privacy Issues and Its Impact on Corporate Counsel, Association of Corporate Counsel and Baker & McKenzie Forum (Atlanta, Georgia) (April 2004). Global Benefit Plans: HIPAA and Data Protection Regulations, National Foreign Trade Council, Annual International HR Management Conference (Houston, Texas) (February 2004). Spam and Anti-Spam Legislation; Managing the Risks, CLE International Forum on Intellectual Property and Technology Law (Research Triangle Park, North Carolina (January 2004). Current Trends in and Political Implications of Offshore Outsourcing, Chicago Council on Foreign Relations (December 2003). Global HR Databases and Employee Monitoring Issues, Baker & McKenzie Seminar (June 2003). Global Privacy Issues, Aetna Global Benefits Forum (Atlanta, GA)(June 2003) Update on Cross-Border Data Privacy Issues, National Foreign Trade Council Annual International Human Resources Conference (Houston, TX) (February 2003) Global Privacy and Security Issues Facing Multinationals, U.S. Department of Commerce and Foreign Commercial Service Seminar (Washington, DC) (August 2002) Privacy Issues Online and Offline, Illinois Bar Association Continuing Legal Education Seminar (Bloomington, IL) (April 2002) Financial Privacy and Electronic Authentication Issues, National Conference of Higher Education Loan Programs (Breckenridge, CO) (March 2002) Dealing with Data Transfer out of Europe, Baker & McKenzie Privacy Seminar (London, England) (December 2001) The US-EU Safe Harbor Data Privacy Arrangement and other Approaches to Data Exports from Europe to the United States, Baker & McKenzie Privacy Seminar (Brussels, Belgium) (December 2001). The US-EU Safe Harbor Data Privacy Arrangement and Associated Data Privacy Laws, the Electronic Signatures in Global and National Commerce Act, and Other E- Commerce Legal Issues, Continuing Legal Education Online, Direct Satellite Broadcast to Thousands of Attorneys in Eleven U.S. States (Dallas, Texas) (July 2001). Legal and Regulatory Issues in Global E-commerce, the Software and Information Industry Association Forum (Denver, Colorado) (June 2001). 4
E-Privacy Across Borders: the US-EU Safe Harbor Data Privacy Arrangement, Global Privacy, and Other E-commerce Issues, Baker & McKenzie (Chicago, Illinois) (May 2001). The United Nations Model Law on Electronic Signatures and Related Legal Issues, Chicago Bar Association Computer Law Committee Forum (Chicago, Illinois) (April 2001). The Global Implications of E-Signatures, the Electronic Financial Services Council Forum (Washington, DC) (May 2000). Jurisdiction and Data Privacy, Senator Bennett s Annual Forum on Electronic Commerce and Financial Services (Salt Lake City, Utah) (February 2000). The European Union Data Privacy Laws, BNA Forum on E-Commerce and Internet Regulation (Washington, DC) (November 1999). Financial Services Issues Related to the European Union Data Privacy Laws, Consumer Bankers Association Annual Meeting (Washington, DC) (November 1999). Electronic Authentication and Contracting, Annual Conference of the Bankers Association for Foreign Trade (Chicago, Illinois) (October 1999). Articles: Privacy, Technology and Transfer of Personal Data, KLUWER INTERNATIONAL LABOR AND EMPLOYMENT LAW HANDBOOK (forthcoming Fall 2010). Why Are More Companies Joining the US-EU Safe Harbor Privacy Framework, The Privacy Advisor for the International Association of Privacy Professionals (January - February 2010). Global Internal Investigations: How to Gather Data and Documents Without Violating Privacy Laws, BNA International World Data Protection Report (July 2008). State Security Breach Laws Risks of Outsourcing, Firm Client Alert on Privacy and Information Management (February 2008). The Extended Enterprise: Legal Hazards of Global Sourcing, Practicing Law Institute (PLI) Outsourcing and Offshoring 2007 Handbook (July 2007). Data Security Breach: A New Litigation Frontier, Firm Client Alert (July 2007). Global Privacy Regulations and HR Outsourcing Arrangements: How to Manage the Regulatory Risks, The Privacy Advisor for the International Association of Privacy Professionals (June 2006). The Conflict Between US Whistleblower Helplines and Non-US Data Protection Requirements: Do the New French Guidelines Provide the Solution? The Privacy Advisor for the International Association of Privacy Professionals (January 2006). 5
US Helplines Raise EU Privacy Concerns, Ethikos and Corporate Conduct Quarterly (September/October 2005). Global Data Transfers and the European Directive: A Practical Analysis of the ICC Model Contract Clauses, BNA Privacy and Security Reporter (February 2005); also published in the World Internet Law Report (February 2005), and the BNA Electronic Commerce and Law Report (February 9, 2005). Outsourcing to India: Key Legal and Tax Considerations for U.S. Financial Institutions, Baker & McKenzie Client Alert (April 2004). U.S. CAN-SPAM Act Imposes New Requirements on Corporate E-mail Marketing, Baker & McKenzie Client Alert (January 2004). Outsourcing, Offshoring, and Employee Privacy Rights, Privacy Litigation Reporter (September 2003). And You Thought HIPAA Was the Tough Part: The European Union Cracks Down on Information Sharing, Business Law Today, Volume 11, Number 2 (November/ December 2001). News Reports: Quoted in Moneylaundering.com News, EU Proposal Would Require U.S. Banks to Turn Over Data to European Investigators (March 25, 2010). Quoted in Moneylaundering.com News, EU Rejection of Swift Data Sharing Agreement Leaves U.S. Scrambling (February 12, 2010). Quoted in BNA Privacy and Security Law Report, Data Breaches: State Attorneys General Fill Important Gap in Data Security Enforcement (July 16, 2007). Quoted in Financial Services Law 360, Bill Would Fix Federal Privacy Loophole (June 12, 2007). Quoted in Fortent Inform, State Banking Groups Sue TJX for Breach-Related Losses (April 25, 2007). Quoted in Moneylaundering.com News, EU Privacy Laws Snag SWIFT (December 7, 2006). Quoted in the BNA Electronic Commerce and Law Report, Data Security No Longer a Technical Issue; Lawyers Point to Corporate Legal Obligations (April 13, 2005). Quoted in the BNA Electronic Commerce and Law Reporter, Varying Privacy Laws Around Globe Present Challenges for US Companies (January 5, 2005). Quoted in the BNA Privacy and Security Reporter, CAN-SPAM Act Requires Tough Decisions Before E-Mail Marketing Efforts, Lawyers Say (February 25, 2004). 6
Quoted in the Washington Times, No Slap on the Wrist for Spam in South Korea (September 2, 2003). Quoted in the BNA Privacy and Security Reporter, US-Based Firms Should Be Wary of Privacy Boundaries for European Workers (June 23, 2003). Quoted in the Chicago Lawyer, Clock Running on Time to Comply with EU Privacy Directive (February 2002). Quoted in the Chicago Daily Law Bulletin, EU data privacy rules loom for multinationals (November 29, 2001). Quoted in the Economist Intelligence Unit, Private Investigations: Data privacy and the Challenge to Business (October 24, 2001). Quoted in the BNA Law Week, UNCITRAL Amends Draft E-Signature Law To Include Freedom of Contract Language (October 17, 2000). Quoted in the BNA Electronic Commerce Reporter, Coming Soon to a Web Site Near You: Europe's Data Privacy Protection Policy (November 24, 1999). Professional Affiliations Mr. Hengesbaugh is a member of the advisory board to the Privacy Advisor, a monthly publication of the International Association of Privacy Professionals. He is also a member of the ABA International Law Section. Awards, Honors & Skills Mr. Hengesbaugh was named as one of the top privacy attorneys in the Computer World Ranking of Top Privacy Consultancies, and he is a member of the Privacy Steering Committee at the Firm. He also is accredited as a Certified Information Privacy Professional (CIPP) by the International Association of Privacy Professionals. Mr. Hengesbaugh received the U.S. Department of Commerce Bronze Medal Award for his outstanding accomplishment in negotiating a safe harbor arrangement with the European Union (April 2000). Education & Bar Admittance Mr. Hengesbaugh received his A.B. degree with a major in Economics and a minor in Psychology from Washington University School of Arts & Sciences. He received his Juris Doctorate, cum laude, from the University of Minnesota Law School. He also attended Central European University Law School in Budapest, Hungary, from which he received a certificate for earning ten credits. He is admitted to the bar in the State of Illinois and in the State of Indiana. 7